Hane Platform

Integrations

Connections and secrets, imports and exports, customer APIs and the API Gateway, portal flows, webhooks, and how Hane handles MCP.

This page explains how Hane connects to outside systems. It separates the ways out of Hane from the ways in, and notes what is available today.

Overview

Direction	Mechanism	Definitions and APIs
Hane → outside	Read from and write to a remote system	`Connection` in `integrations/v1alpha1`
Hane → outside	Deliver events to your systems	Event subscriptions (webhooks)
Outside → Hane	Publish your APIs through Hane’s entry point	`Route`, `PublishedApi`, `Consumer` in `gateway/v1alpha1`
Outside → Hane	Your apps or CI call the public API	Service accounts and API keys

Connections

You describe each outside connection in a Connection and activate it in a ReleaseBundle. provider sets the kind.

`provider`	What it does	Availability
`api`	Registered HTTP operations that agents can use, or the backend of a Route	Available
`hr`	Imports employees and departments from an HR register (`POST /v1/integrations/sync-jobs`)	Available
`accounting-csv`	Exports CSV for accounting (`POST /v1/integrations/exports`)	Available
`portal`	Reads and imports a list from a web portal that requires login	Preview
`storage`	Reads an external storage location and syncs it as documents (read-only)	Preview

An api connection registers each operation with an HTTP method, path, impact, and input and output JSON Schemas. Callers cannot choose arbitrary URLs.

apiVersion: integrations/v1alpha1
kind: Connection
metadata:
  name: calendar
spec:
  provider: api
  endpoint: https://calendar.example.com
  secret: calendar-api-token
  operations:
    get-busy:
      method: GET
      path: /calendar/freebusy
      impact: read
      input:
        type: object
        additionalProperties: false
        required: [calendar, from, to]
        properties:
          calendar: { type: string }
          from: { type: string, format: date }
          to: { type: string, format: date }
      output:
        type: object

Only GET is read; every other method is write. When an agent calls a write operation (integration.execute), Hane turns it into an ActionRequest and runs it exactly once after approval.

Secrets

Register API tokens and similar values as secrets (PUT /v1/integrations/secrets/{name}, which requires secrets:write).

Values are stored encrypted and cannot be seen in the API or the console after they are saved.
Only import jobs and authorized calls to customer APIs use the values. They are never given to agents or models.
For connections that use the OAuth 2.0 authorization code flow (with PKCE), an administrator consents in the console, and Hane keeps the token as a secret and refreshes it when it nears expiry.
With rotation, Hane rotates the secret every set number of days. A rotation that left an old value at the remote side stays listed as needing action until a person records how it was resolved.

API Gateway

The API Gateway lets callers reach your APIs through Hane’s entry point.

Definition	Role
`Route`	The path from the entry point to an `api` connection, with path, methods, and timeout
`PublishedApi`	One of your APIs published on a Route, described with OpenAPI
`Consumer`	A caller of a PublishedApi, with its own API keys and limits
`ToolExposure`	Turns one PublishedApi operation into an agent tool

Internal callers use /v1/gateway/invoke/{route}/… (which requires gateway:routes.call); Consumers use /v1/gateway/published/{api}/….
The caller’s credentials and cookies are never forwarded. By default, the backend receives a 60-second token signed with the connection’s secret, issued per call. Routes and PublishedApis can instead pass the secret itself (backendAuth: connection_secret). Agent calls through a ToolExposure always use the short-lived token.
A Consumer’s API key is shown only once when issued. Revoked keys are rejected from the next request.
Call records (without bodies) are available from GET /v1/gateway/calls.

Portal flows Preview

For web portals without an API, you define steps in a BrowserFlow, and an agent runs it with browser.run_flow. Because this is an outbound action, it needs approval. For portals inside your network, you place a browser runner in your network or on an employee’s machine; it connects outbound to Hane to pick up work. Portal passwords stay with the runner and are never sent to Hane.

Handing over to a person when a CAPTCHA or multi-factor prompt appears, and signed runner releases, are not ready yet.

Webhooks

Hane can deliver events, such as a case completing, to your systems over HTTP. Register an event subscription per project and environment (/v1/workflows/event-subscriptions); the receiver verifies the signature with the signing secret. Redelivery of the same event counts as the same delivery. See Receiving webhooks for registration and receiver code.

About MCP

To use Hane from outside, call the public API (API reference).

Next steps

Receiving webhooks

Agents and AgentRuns

Security and data handling

API reference